Def Con: How to virtually kill someone or cash in on fake babies

Thanks to an 'end of life' vulnerability, almost anyone can kill you off digitally; you could virtually kill off a boss-from-hell or an ex. Imagine the nightmare of trying to get an official ID then. The virtual birthing process is even easier to exploit, according to Chris Rock's 'I will kill you & birth you' presentation at Def Con 23.

Forget the odds of being killed by a gun, in a car wreck or another freak accident as you can be killed off by someone on the other side of the world wielding a keyboard and not even know it until you applied for something linked to your official ID. The entire process of virtually killing and birthing someone is incredibly easily, according to Chris Rock who presented “I will kill you & birth you” (pdf) at Def Con 23. “You could kill anyone you want,” he said. “No one is off limits.”

Rock, the founder and CEO of security firm Kustodian, became interested in this chain of thought after a big oops by an Australian hospital that accidentally killed off 200 patients by mistake. When he started looking into it, he found gaping vulnerabilities that could potentially affect “hundreds of millions of people.” Governments rushed the digital process to register deaths and births, creating a “global problem affecting the U.S., Canada, Australia, New Zealand and Europe;” Anyone following the simple steps outlined in his Def Con talk can “kill another person or group of people” – can commit “‘mass murder’ on digital paper for revenge, kicks or profit.”

Virtual killing process

You can look up doctors online to get their license number, address and other identifying information that could then be entered in the Electronic Death Registration System (EDRS) which each state runs. General practitioners, for example, usually don’t setup accounts to fill out death certificates yet a GP’s identifying info is online. Rock used the California's online license verification for physicians as an example of how anyone can set up a doctor’s account. Once a person registers as a doctor, he or she can fill out death and birth certificates.

Learning to fill out death certificates doesn’t take a degree as that info can found in “an idiot’s guide for doctors” such as the CDC’s “Physicians’ handbook on medical certification of death”(pdf); it gives info such as determining whether a death is reportable or reviewable. Registering cause of death is as easy as selecting the cause from a dropdown box; Rock warned against selecting a cause of death that would trigger a coroner’s review.

Next, a funeral director completes death certificate documents; luckily there is an online process to “become” a funeral director. Rock created a funeral home website and registered online to be a funeral director in Australia. After filling out that online application, Rock received an email verification that he had been “successfully added to our contacts data to submit online death registrations.” In the UK, anyone can set themselves up as a Funeral Director “without previous experience, training, qualifications or license.”

Rock’s examples of what it takes to be a U.S. funeral director included California’s requirement of having an Associate of Arts or equivalent degree in any subject and Colorado’s “no current licensing requirements.” Again the CDC has helpful resources such as the “Funeral Directors' Handbook on Death Registration and Fetal Death Reporting” (pdf). Rock used Jeff Moss, aka Dark Tangent, in his death certificate example.

Rock listed numerous reasons why someone would want to virtually kill a person; it might be for financial gain such as collecting life insurance while living it up or killing off elderly parents in order to take their estate. Revenge porn is unfortunately something that happens, but Rock suggested virtually “killing off an ex-wife, girlfriend or partner” could be motivated by revenge; another revenge motive involved killing off a boss-from-hell and then acting as their executor to shut down bank accounts, their driver’s license, utilities, cable and phone plan. To “hinder” was yet another potential reason to virtually kill someone; since dead folks can’t travel or issues subpoenas, virtually killing off investigating detectives could hinder an investigation; another “hinder” scenario involved killing off “your opposing lawyer, the judge or IRS audit officer to slow them down.”

“You could be dead right now and not even know it,” Rock said. A person who has been virtually killed might not know about it until they apply for a passport or driver’s license. And trying to reverse it doesn’t mean a person could for sure. An example included a man who was declared legally dead but was an alive, roaming alcoholic; an Ohio judge said the law in his state would not allow a death to be reversed after three or more years had passed. “I don’t know where that leaves you, but you’re still deceased as far as the law is concerned,” the judge told the man. Rock quoted the judge as stating, “Even though you’re sitting here in my courtroom, I see you, you’re alive, you seem to be in good health, the law restricts me from reversing the prior finding of death.”

It’s even easier to virtually birth a person than it is to kill them. A midwife instead of a doctor could do an online birth registration process in the USA; or parents could do so as Rock used an Arizona Office of Vital Records example that explains how to register a home birth.

Just as Rock provided possible motives to commit a virtual killing, he also presented possible motives for a virtual birthing. Someone might make virtual babies to get “a do over” after bankruptcy, getting a criminal record or after being sued. They might create a virtual baby to use it as a spare identity, or to collect government benefits and tax concessions. He added, “You could even make fake identities for your children, so when they grow up they have burner identities.”

In Rock’s book, he explained “The Baby Harvest” as a “concept of a criminal syndicate: making and raising virtual babies to adulthood to be put on the shelf for money laundering, fraud and drug and firearm importation.” Rock said eventually the fake babies could be harvested, as in ‘killed off,’ at investment maturity.

Although shelf babies would be a long-term investment, they have the most benefits as those “virtuals” could borrow millions of dollars, launder money, take out life insurance policies, buy guns and drugs, or be sold. Virtual identities could also be used to enhance anonymity; if a person were to use TOR or a VPN, use bitcoin to make payments, yet still end up getting busted…the trail would supposedly lead back to a virtual person who never existed in real life in the first place.